EU Data Act: how to switch your data processing service

Since when the rules apply

Since 12 September 2025, Chapter VI of the EU Data Act (Arts. 23–31 of Regulation (EU) 2023/2854) has also applied to existing cloud, SaaS and CRM contracts — regardless of the term originally agreed. It covers data processing services within the meaning of Art. 2(8) Data Act, i.e. practically all cloud offerings: SaaS, PaaS, IaaS. This is particularly relevant for CRM systems: they usually contain a company's most business-critical data — customer contacts, sales history, quotations, communication histories — and at the same time are often sold with long terms and automatic renewal, precisely because providers knew how difficult switching used to be. It is exactly this combination that the Data Act addresses as a statutory derogation from the contractual commitment: if the provider's own standard terms (AGB) contain a notice period of more than two months — one- or two-year commitments are also common in cloud and CRM contracts — or additional switching obstacles, these clauses are likely to be unenforceable as against the Data Act. Exceptions apply only to special solutions custom-built for a single customer and to pure trial versions.

Switching in practice

The switch itself does not require formal termination. An informal notification to the provider that a switch is requested is sufficient — ideally in text form and with an express reference to the EU Data Act. From receipt of this notification, the maximum notice period of two months runs (Art. 25(2)(d)); within this period the provider must initiate the switch, but it does not yet terminate the contract. The actual switching period, during which the migration takes place, then begins — in principle 30 calendar days (Art. 25(2)(a)). The provider may extend it once for technical reasons to up to seven months, but must announce this within 14 days of receipt of the switching notification (Art. 25(4)); the customer can also request an extension if more time is needed. Throughout this entire period, the provider must continue to operate the service without disruption and actively support the data export.

Data export when switching CRM

For CRM switches, the data export is the real bottleneck. The provider must make all exportable data and digital assets available in a structured, commonly used, machine-readable format — via open interfaces, where available. For a CRM, this means specifically: contact, deal and activity data must be provided in such a way that it can be imported into a new system, not merely as an unstructured raw export in a proprietary format that nobody can process meaningfully. After the switching period has ended, there is also a retrieval period of a further 30 days before the old provider must delete the data. Once the switch has been successfully completed, the contract ends by operation of law (Art. 25(2)(c)); it is advisable to have the date confirmed in writing and to expressly request deletion after the retrieval period has expired.

Costs of switching

Caution is required with regard to costs: until 12 January 2027, providers may still charge reduced, cost-based switching charges, which may not exceed the costs actually incurred by them as a result of the switch. From 12 January 2027, switching charges are prohibited entirely (Art. 29). These must be distinguished from standard service fees and contractually agreed penalties for early termination — these may continue to be owed independently of the Data Act. The Data Act therefore does not automatically force the provider to waive remuneration for the originally agreed remaining term (Recital 89); whether, and in what amount, payments are still owed after the switch depends on the specific contractual arrangements.

Assessment

The Data Act is still young — decisions of the highest courts, the BGH (Federal Court of Justice) or the CJEU (EuGH), on individual questions of interpretation, for example on the precise scope of “functional equivalence” under Art. 24, are not yet available. However, this is no reason for restraint: the Regulation lays down deadlines, formats and duties to cooperate in sufficiently concrete terms for the switch to work in practice, even without a leading decision from the highest courts. If a provider nevertheless refuses to cooperate, unreasonably delays the switch or demands impermissible switching charges, there are clear options for action: a lawyer's demand setting a deadline, a complaint to the Bundesnetzagentur (Federal Network Agency) as the competent German supervisory authority since May 2026 — fines of up to 500,000 euros are possible — and civil law claims for breach of duty.